KYOCERA Document Solutions
PHP2Shell Vulnerabilities (Updated)
On October 21, 2026, two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) were disclosed. Our investigation into the impact on our products confirmed that several products are affected. The following provides an overview of the vulnerabilities and the recommended countermeasures.
Vulnerability Overview
CVE-2026-109618 - Remote Code Execution Caused by Memory Corruption During an Out-of-Memory Condition
CVE-2026-109619 - Remote Code Execution Caused by Residual Internal State
If these vulnerabilities are exploited, an unauthenticated remote attacker may be able to execute arbitrary code on an affected system. This could affect the confidentiality, integrity, and availability of data and services, including unauthorized access to information, modification of system data, installation of malicious software, and service disruption.
Products Affected by These Vulnerabilities
| Product | Affected Versions |
|---|---|
| KYOCERA Net Manager / aQrate | 10.2 (Patch 26), 8.2 (Patch 61) and earlier |
| Printing System 50/50A | Version-independent |
| Printing System 18 | Version-independent |
| Printing System 17 | Version-independent |
| Printing System 15/16 | Version-independent |
Countermeasures
Please apply the following security patches to address these vulnerabilities.
| Product | Fixed Versions |
|---|---|
| KYOCERA Net Manager / aQrate | 10.2 (Patch 29) |
Workarounds
No permanent workaround is available. The security patch must be applied.
Until the fixed version is applied, prevent direct access from the internet and restrict access to only the required networks, users, and devices. Monitoring the server for suspicious activity may help reduce the risk. We will provide further information as soon as the security patches are ready.
Inquiries
Customers except within EU
KYOCERA Document Solutions Inc., Corporate Communication Section
Customers within EU
KYOCERA Document Solutions Europe B.V.
Kyocera Document Solutions Inc. ensures adherence to local data protection regulations. We have detected that your inquiry comes from within the EU. Therefore, due to the EU's General Data Protection Regulation, please note that your request will be forwarded to our regional headquarter: Kyocera Document Solutions Europe.
| * | This article is current, as of the date of publication. |
